ASA5510 adnd L2L tunnel in L2L tunnel

[Oleg Volkov]

Dear Sirs!

I need to create a VPN between two networks. But the traffic is coming from the ASA  number 1 to ASA number 2 must to go through the server BSD.

I think, I will create a tunnel from each ASA to BSD, and over this tunnel another tunnel betwin two ASA.

In the router, I can make a Tunnel interface, and crypto map at this interface.

and route from one ASA to another ASA through Tunnel interface.

(I will get IPSec tunnel in GRE tunnel).

In this example, I have IP address on Tunnel interfaces as IPSec peers

But how to do it on the ASA (ASA do not support tunnel interface)?

Thanks!

[Karsten Iwen]

These kind of configuration can't be done with the ASA. But why do you want to do that? Perhaps there is a better solution for your needs.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Oleg Volkov]

I need tunnel between two ASA, but traffic must to go through the server BSD. My client, whant monitoring encrypted traffic at BSD server (I do not understand what, but client want :-) )

May be, I can resolve it only by routing?

Can I route packet from ASA №1 to ASA №2 through BSD server who do not place in same betwork segment with ASA?

I think, I can not do it.

[Karsten Iwen]

You can solve it with routing if every router between the ASA and the BSD-Box is aware of this routing-path.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Oleg Volkov]

BSD placed in other city, and connected to Internet.

[Karsten Iwen]

Then you need an additional router in front of the ASA that builds a second tunnel to the BSD-box.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Oleg Volkov]

It is true, but I try to find other method :-)

[Oleg Volkov]

Dea Sirs!

If I will be use router in front of the ASA and will be use GRE tunnel without protection, what router You recommended?

I look at Cisco 880,890 or Cisco 1841.

If I will be use only GRE tunnels on this router, what throughput I get?

Thanks!

[Karsten Iwen]

Which throughput do you want to achieve? The 890 (ISR G2) is faster them a 1841 (ISR G1). The 880 is the slowest from your list (about half the speed of the 890). For the 890 I would assume a usable throughput of about 50 to 80 MBit/s without any additional services.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni